DNSKEY Lookup
Public keys used to sign a DNSSEC zone.
Enter a value above to run DNSKEY Lookup
e.g. cloudflare.com
Quick answer
A DNSKEY lookup returns the public keys a zone uses to sign its records with DNSSEC, which resolvers use to verify those records are authentic. Zones typically publish a Zone Signing Key (ZSK) and a Key Signing Key (KSK), the latter being what the parent's DS record points to.
DNSKEY Lookup retrieves the public keys a zone publishes to support DNSSEC. These keys let resolvers verify the RRSIG signatures attached to a zone's records, proving the answers came from the real zone and were not tampered with in transit. A zone typically publishes one or more Key Signing Keys (KSK) and Zone Signing Keys (ZSK). This tool is useful when you enable DNSSEC, rotate keys, or debug validation failures, because it shows exactly which keys a resolver would trust for that domain.
How to read the results
Each DNSKEY record has four fields: flags, protocol, algorithm, and the Base64 public key. Flags of 257 mark a Key Signing Key (KSK, the secure entry point), while 256 marks a Zone Signing Key (ZSK). Protocol is always 3. The algorithm number identifies the crypto, for example 8 (RSA/SHA-256) or 13 (ECDSA P-256). The key data itself is the public half used to check signatures.
How it works
The tool sends a DNS query of type DNSKEY to the domain's authoritative servers and returns every key in the set. The KSK signs the DNSKEY RRset and matches the DS record held by the parent zone, forming the chain of trust. The ZSK signs the individual records. A resolver hashes your KSK and compares it to the parent's DS record to decide whether these keys can be trusted.
Common problems & fixes
Getting no DNSKEY records usually means DNSSEC is not enabled on the zone. If keys exist but validation still fails, the DS record at your registrar likely does not match the current KSK, often after a key rollover. Compare the KSK's key tag against the DS. Also check that the algorithm in the DS matches the DNSKEY, since a mismatch breaks the chain even when both records look present.
Frequently asked questions
- What is the difference between a KSK and a ZSK?
- A Key Signing Key (flags 257) only signs the DNSKEY set and is the key referenced by the parent's DS record, so it is your anchor to the chain of trust. A Zone Signing Key (flags 256) signs all the other records in the zone. Splitting roles lets you rotate the ZSK frequently without touching the registrar.
- Why does my DNSKEY exist but DNSSEC still fails?
- Publishing keys is only half of DNSSEC. The parent zone must also hold a DS record that hashes your KSK. If the DS is missing, points to an old key, or uses a different algorithm, resolvers cannot build a valid chain and will return SERVFAIL. Verify the DS at your registrar matches the current KSK's key tag and algorithm.
- What does the algorithm number mean?
- It identifies the signing algorithm. Common values are 8 (RSASHA256), 13 (ECDSA Curve P-256 with SHA-256), and 15 (Ed25519). Algorithm 13 and 15 produce much smaller keys and signatures than RSA, which reduces DNS response sizes. All resolvers you care about should recognize 8 and 13; 15 support is now widespread but slightly newer.